What is claimed is; 

1. A method for detecting abnormal traffic at the network 
level using a statistical analysis, the method comprising the 

5 steps of: 

a) gathering local traffic data from each network device 
and integrating a plurality of the local traffic data to 
generate traffic data in a network level; 

b) extracting a characteristic traffic data based on the 
10 traffic data in the network level; 

c) comparing the characteristic traffic data with a 
characteristic traffic data profile resulting from statistical 
computations, and determining whether there is abnormal 
traffic in the network; and 

15 d) updating the characteristic traffic data profile using 

the characteristic traffic data if there is no abnormal 
traffic in the network, analyzing seriousness of the abnormal 
traffic and monitoring the abnormal traffic if there is 
abnormal traffic in the network. 

20 

2. The method as recited in claim 1, wherein the 
characteristic traffic data includes: 

information on traffic assigned to an application port 
which is selected according to an application service; 
25 information on traffic of which packet size is identical; 

and 

information on traffic of which the number of source- 

10 



destination pairs, which represents the number of source 
addresses of the traffic having the same target address. 

3. The method as recited in claim 1, further comprising 
5 the step of e) transmitting the analysis result of the 

seriousness of the abnormal traffic to an abnormal traffic 
processing system. 

4 . A computer-readable recording medium for storing a 
10 program that implements a method for detecting abnormal 

traffic at the network level using a statistical analysis, the 
method comprising the steps of: 

a) gathering local traffic data from each network device 
and integrating a plurality of the local traffic data to 

15 generate traffic data in a network level; 

b) extracting a characteristic traffic data based on the 
traffic data in the network level; 

c) comparing the characteristic traffic data with a 
characteristic traffic data profile resulting from statistical 

20 computations, and determining whether there is abnormal 
traffic in the network; and 

d) updating the characteristic traffic data profile using the 
characteristic traffic data if there is no abnormal traffic in 
the network, analyzing seriousness of the abnormal traffic and 
25 monitoring the abnormal traffic if there is abnormal traffic 
in the network. 
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